@mriekki/project-forge 4.6.0 → 4.8.0

package/assets/generated/deployment/src/project_forge_deployment/app_deployment.py

@@ -10,15 +10,19 @@ from __future__ import annotations
 
 from typing import Any, Iterable
 
+from .app_runtime import PRODUCTION_APP_DEPLOY_WRITE_PHRASE
 from .app_runtime import apply_app_deploy as _apply_runtime_deploy
+from .app_runtime import deploy_write_phrase
 from .app_runtime import plan_app_deploy as _plan_runtime_deploy
 from .app_runtime_workstation import apply_app_deploy_with_preloaded_image
 from .environment_isolation import environment_isolation_preflight
 from .errors import DeploymentKitError
 from .image_transfer import transfer_image
+from .route_registry import ROUTE_WRITE_PHRASE, plan_route_registration
 
 
 ISOLATION_REVIEW_KEY = "isolationReview"
+ROLLOUT_SCHEMA_VERSION = 1
 
 
 def app_isolation_check(
@@ -139,6 +143,100 @@ def plan_app_deploy(
     return plan
 
 
+def _endpoint_states(route_plan: dict[str, Any] | None) -> dict[str, str]:
+    if route_plan is None:
+        return {
+            "beforeRuntime": "NO_ROUTE_REQUESTED",
+            "afterRuntimeBeforeRoute": "NO_ROUTE_REQUESTED",
+            "afterRoute": "NO_ROUTE_REQUESTED",
+        }
+    if route_plan["changeType"] == "create":
+        before = "NOT_ACTIVE_ROUTE_ABSENT"
+        after_runtime = "NOT_ACTIVE_ROUTE_PENDING"
+    else:
+        before = "ROUTE_PRESENT_RUNTIME_STATE_NOT_VALIDATED"
+        after_runtime = "ROUTE_PRESENT_ROUTE_CHANGE_PENDING"
+    return {
+        "beforeRuntime": before,
+        "afterRuntimeBeforeRoute": after_runtime,
+        "afterRoute": "ROUTE_REGISTERED_BROWSER_VERIFICATION_PENDING",
+    }
+
+
+def plan_app_rollout(
+    target_name: str,
+    spec: dict[str, Any],
+    *,
+    production: bool = False,
+    database_file: str | None = None,
+    route_hostnames: Iterable[str] | None = None,
+) -> dict[str, Any]:
+    """Compose read-only runtime and route plans into one staged rollout preview."""
+
+    hosts = list(route_hostnames or [])
+    app_plan = plan_app_deploy(
+        target_name,
+        spec,
+        production=production,
+        database_file=database_file,
+        route_hostnames=hosts,
+    )
+    route_plan = None
+    if hosts:
+        route_plan = plan_route_registration(
+            target_name,
+            owner_repo=spec["ownerRepo"],
+            environment=spec["environment"],
+            app_slug=spec["appSlug"],
+            upstream_container=spec["containerName"],
+            upstream_port=spec["runtimePort"],
+            hostnames=hosts,
+        )
+
+    runtime_authorization = (
+        PRODUCTION_APP_DEPLOY_WRITE_PHRASE
+        if production or spec["environment"] == "production"
+        else deploy_write_phrase(app_plan)
+    )
+    stages = [
+        {
+            "stage": "runtime",
+            "action": "deploy-application-runtime",
+            "requiredAuthorization": runtime_authorization,
+            "mutated": False,
+        }
+    ]
+    if route_plan is not None:
+        stages.append(
+            {
+                "stage": "route",
+                "action": "register-application-route",
+                "requiredAuthorization": ROUTE_WRITE_PHRASE,
+                "mutated": False,
+            }
+        )
+
+    runtime_view = {key: value for key, value in app_plan.items() if key != "spec"}
+    return {
+        "schemaVersion": ROLLOUT_SCHEMA_VERSION,
+        "targetName": target_name,
+        "environment": spec["environment"],
+        "production": bool(production or spec["environment"] == "production"),
+        "image": spec["image"],
+        "runtimePlan": runtime_view,
+        "routePlan": route_plan,
+        "stages": stages,
+        "separateAuthorizationsRequired": route_plan is not None,
+        "endpointState": _endpoint_states(route_plan),
+        "postRouteVerification": (
+            ["application-health", "route-http", "workstation-browser"]
+            if route_plan is not None
+            else ["application-health"]
+        ),
+        "mutated": False,
+    }
+
+
 def revalidate_app_isolation(plan: dict[str, Any]) -> dict[str, Any]:
     """Recheck the reviewed application footprint immediately before mutation."""
 
@@ -186,9 +284,11 @@ def apply_app_deploy_from_workstation(plan: dict[str, Any]) -> dict[str, Any]:
 
 __all__ = [
     "ISOLATION_REVIEW_KEY",
+    "ROLLOUT_SCHEMA_VERSION",
     "app_isolation_check",
     "apply_app_deploy",
     "apply_app_deploy_from_workstation",
     "plan_app_deploy",
+    "plan_app_rollout",
     "revalidate_app_isolation",
 ]

package/assets/generated/deployment/src/project_forge_deployment/entrypoint.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import sys
 
+from .access_cli import main as access_main
 from .app_cli import main as app_main
 from .cli import main as core_main
 from .environment_cli import main as environment_main
@@ -16,6 +17,8 @@ from .topology_cli import main as topology_main
 
 def main(argv: list[str] | None = None) -> int:
     args = list(sys.argv[1:] if argv is None else argv)
+    if args and args[0] == "access":
+        return access_main(args[1:])
     if args and args[0] == "app":
         return app_main(args[1:])
     if args and args[0] == "environment":
@@ -31,6 +34,7 @@ def main(argv: list[str] | None = None) -> int:
     if args and args[0] == "topology":
         return topology_main(args[1:])
     if not args or args == ["--help"] or args == ["-h"]:
+        print("Command group: access  Read-only strict SSH target-access diagnosis")
         print("Command group: app  Remote immutable application runtime inventory/deployment")
         print("Command group: environment  Portable profiles, Home Lab onboarding, and image transfer")
         print("Command group: local  Loopback-only workstation application runtime")

package/assets/generated/deployment/src/project_forge_deployment/registry_access.py

@@ -1,7 +1,8 @@
-"""Read-only exact-image registry access verification for logical targets."""
+"""Read-only exact-image registry capability verification by execution context."""
 
 from __future__ import annotations
 
+import os
 import re
 import shlex
 import subprocess
@@ -13,6 +14,17 @@ from .ssh import ssh_args, verify_access
 
 
 _IMAGE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/:+-]*@sha256:[0-9a-f]{64}$")
+_REMOTE_DOES_NOT_PROVE = [
+    "workstation-registry-access",
+    "workstation-image-pull",
+    "actions-registry-transport",
+    "package-metadata-api-access",
+]
+_WORKSTATION_DOES_NOT_PROVE = [
+    "remote-target-registry-access",
+    "actions-registry-transport",
+    "package-metadata-api-access",
+]
 
 _REMOTE_SCRIPT = r'''#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -61,6 +73,14 @@ printf 'ACCESS\t%s\n' "$credential_state"
 '''
 
 
+class RegistryCapabilityError(DeploymentKitError):
+    """Fail-closed registry capability error with safe structured evidence."""
+
+    def __init__(self, message: str, result: dict[str, Any]) -> None:
+        super().__init__(message)
+        self.result = result
+
+
 def normalize_registry_image(value: str) -> str:
     if not isinstance(value, str) or _IMAGE_RE.fullmatch(value) is None:
         raise DeploymentKitError(
@@ -83,13 +103,55 @@ def _parse_access(output: str) -> str:
     return parts[1]
 
 
+def _remote_failure_result(
+    *,
+    name: str,
+    image: str,
+    address: str,
+    returncode: int,
+) -> dict[str, Any]:
+    failure_codes = {
+        42: "docker-cli-unavailable",
+        43: "credential-config-unsafe",
+        44: "manifest-access-failed",
+    }
+    return {
+        "status": "failed",
+        "executionLocation": "remote-target",
+        "targetName": name,
+        "verifiedAddress": address,
+        "capabilityAttempted": "registry-manifest-read",
+        "image": image,
+        "failureCode": failure_codes.get(returncode, "remote-command-failed"),
+        "doesNotProve": list(_REMOTE_DOES_NOT_PROVE),
+        "mutated": False,
+    }
+
+
+def _workstation_failure_result(*, image: str, failure_code: str) -> dict[str, Any]:
+    return {
+        "status": "failed",
+        "executionLocation": "workstation",
+        "credentialContext": "workstation-docker-client",
+        "dockerConfigSource": "explicit-environment" if os.environ.get("DOCKER_CONFIG") else "default",
+        "capabilityAttempted": "registry-manifest-read",
+        "image": image,
+        "failureCode": failure_code,
+        "doesNotProve": list(_WORKSTATION_DOES_NOT_PROVE),
+        "mutated": False,
+    }
+
+
 def verify_registry_access(name: str, image: str) -> dict[str, Any]:
+    """Verify exact-image manifest access from the named remote target."""
+
     exact_image = normalize_registry_image(image)
     profile = load_profile(name)
     access = verify_access(profile)
+    address = access["address"]
     command = ssh_args(
         profile,
-        access["address"],
+        address,
         command="bash -s -- " + shlex.quote(exact_image),
     )
     completed = subprocess.run(
@@ -99,16 +161,84 @@ def verify_registry_access(name: str, image: str) -> dict[str, Any]:
         capture_output=True,
     )
     stdout = completed.stdout.decode("utf-8", errors="replace")
-    stderr = completed.stderr.decode("utf-8", errors="replace")
     if completed.returncode != 0:
-        detail = stderr.strip() or stdout.strip() or f"exit {completed.returncode}"
-        raise DeploymentKitError(f"Read-only registry access verification failed: {detail}")
+        result = _remote_failure_result(
+            name=name,
+            image=exact_image,
+            address=address,
+            returncode=completed.returncode,
+        )
+        raise RegistryCapabilityError(
+            f"Remote-target registry capability check failed ({result['failureCode']}).",
+            result,
+        )
 
     credential_state = _parse_access(stdout)
     return {
+        "status": "verified",
+        "executionLocation": "remote-target",
         "targetName": name,
+        "verifiedAddress": address,
+        "credentialContext": (
+            "target-docker-config" if credential_state == "protected" else "target-anonymous"
+        ),
+        "capabilityProved": "registry-manifest-read",
         "image": exact_image,
         "manifestAccess": "verified",
         "credentialConfig": credential_state,
+        "doesNotProve": list(_REMOTE_DOES_NOT_PROVE),
         "mutated": False,
     }
+
+
+def verify_workstation_registry_access(image: str) -> dict[str, Any]:
+    """Verify exact-image manifest access from this workstation without pulling."""
+
+    exact_image = normalize_registry_image(image)
+    command = ["docker", "manifest", "inspect", exact_image]
+    try:
+        completed = subprocess.run(
+            command,
+            check=False,
+            capture_output=True,
+        )
+    except FileNotFoundError as error:
+        result = _workstation_failure_result(
+            image=exact_image,
+            failure_code="docker-cli-unavailable",
+        )
+        raise RegistryCapabilityError(
+            "Workstation registry capability check failed (docker-cli-unavailable).",
+            result,
+        ) from error
+
+    if completed.returncode != 0:
+        result = _workstation_failure_result(
+            image=exact_image,
+            failure_code="manifest-access-failed",
+        )
+        raise RegistryCapabilityError(
+            "Workstation registry capability check failed (manifest-access-failed).",
+            result,
+        )
+
+    return {
+        "status": "verified",
+        "executionLocation": "workstation",
+        "credentialContext": "workstation-docker-client",
+        "dockerConfigSource": "explicit-environment" if os.environ.get("DOCKER_CONFIG") else "default",
+        "capabilityProved": "registry-manifest-read",
+        "image": exact_image,
+        "manifestAccess": "verified",
+        "doesNotProve": list(_WORKSTATION_DOES_NOT_PROVE),
+        "mutated": False,
+    }
+
+
+__all__ = [
+    "RegistryCapabilityError",
+    "build_remote_script",
+    "normalize_registry_image",
+    "verify_registry_access",
+    "verify_workstation_registry_access",
+]

package/assets/generated/deployment/src/project_forge_deployment/registry_cli.py

@@ -1,4 +1,4 @@
-"""CLI for read-only registry access verification."""
+"""CLI for read-only registry capability verification."""
 
 from __future__ import annotations
 
@@ -8,7 +8,11 @@ import sys
 from typing import Any
 
 from .errors import DeploymentKitError
-from .registry_access import verify_registry_access
+from .registry_access import (
+    RegistryCapabilityError,
+    verify_registry_access,
+    verify_workstation_registry_access,
+)
 
 
 def _print(value: Any, *, as_json: bool) -> None:
@@ -28,11 +32,24 @@ def build_parser() -> argparse.ArgumentParser:
 
     verify = sub.add_parser(
         "verify",
-        help="Verify exact-image registry manifest access without pulling or modifying target state",
+        help=(
+            "Verify exact-image registry manifest access on the named remote target without pulling "
+            "or modifying target state"
+        ),
     )
-    verify.add_argument("name")
+    verify.add_argument("name", help="Named remote target profile")
     verify.add_argument("--image", required=True)
     verify.add_argument("--json", action="store_true")
+
+    verify_workstation = sub.add_parser(
+        "verify-workstation",
+        help=(
+            "Verify exact-image registry manifest access from this workstation without pulling "
+            "or modifying target state"
+        ),
+    )
+    verify_workstation.add_argument("--image", required=True)
+    verify_workstation.add_argument("--json", action="store_true")
     return parser
 
 
@@ -45,6 +62,18 @@ def main(argv: list[str] | None = None) -> int:
                 as_json=args.json,
             )
             return 0
+        if args.command == "verify-workstation":
+            _print(
+                verify_workstation_registry_access(args.image),
+                as_json=args.json,
+            )
+            return 0
+    except RegistryCapabilityError as error:
+        if getattr(args, "json", False):
+            _print(error.result, as_json=True)
+        else:
+            print(f"ERROR: {error}", file=sys.stderr)
+        return 2
     except DeploymentKitError as error:
         print(f"ERROR: {error}", file=sys.stderr)
         return 2

package/assets/generated/deployment/src/project_forge_deployment/security.py

@@ -180,27 +180,56 @@ def _posix_directory_chain(path: Path) -> list[Path]:
         current = current.parent
 
 
-def _check_posix_directories(path: Path) -> None:
+def _posix_directory_issues(path: Path) -> list[str]:
+    issues: list[str] = []
+    current_uid = os.getuid()
     for directory in _posix_directory_chain(path):
-        if directory.is_symlink() or not directory.is_dir():
-            raise DeploymentKitError(f"SSH directory must be a real directory: {directory}")
-        if directory.stat().st_mode & (stat.S_IRWXG | stat.S_IRWXO):
-            raise DeploymentKitError(f"SSH directory permissions are too broad: {directory}")
+        if directory.is_symlink():
+            issues.append(f"symbolic link: {directory}")
+            continue
+        if not directory.exists():
+            continue
+        if not directory.is_dir():
+            issues.append(f"not a directory: {directory}")
+            continue
+        details = directory.stat()
+        if details.st_uid != current_uid:
+            issues.append(f"not owned by the current user: {directory}")
+        if details.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
+            issues.append(f"permissions are too broad: {directory}")
+    return issues
+
+
+def _check_posix_directories(path: Path) -> None:
+    issues = _posix_directory_issues(path)
+    if issues:
+        raise DeploymentKitError("SSH directory chain is unsafe: " + "; ".join(issues))
 
 
 def prepare_ssh_directory(path: Path) -> None:
-    """Create one SSH-material directory when absent, then verify its safety before secrets are written."""
+    """Create missing owned SSH directories safely without silently repairing existing unsafe state."""
     _ssh_directory_for(path)
-    if path.exists():
-        if path.is_symlink() or not path.is_dir():
-            raise DeploymentKitError(f"SSH material directory is not a real directory: {path}")
-    else:
-        path.mkdir(parents=True, mode=0o700)
-    if os.name != "nt":
-        path.chmod(0o700)
-        _check_posix_directories(path / "placeholder")
-    else:
+    if os.name == "nt":
+        if path.exists():
+            if path.is_symlink() or not path.is_dir():
+                raise DeploymentKitError(f"SSH material directory is not a real directory: {path}")
+        else:
+            path.mkdir(parents=True, mode=0o700)
         _check_windows_acl(path)
+        return
+
+    probe = path / "placeholder"
+    issues = _posix_directory_issues(probe)
+    if issues:
+        raise DeploymentKitError("SSH directory chain is unsafe: " + "; ".join(issues))
+
+    for directory in reversed(_posix_directory_chain(probe)):
+        if directory.exists():
+            continue
+        directory.mkdir(mode=0o700)
+        directory.chmod(0o700)
+
+    _check_posix_directories(probe)
 
 
 def check_identity_security(identity: Path) -> None:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {

package/src/bootstrap-migrations.mjs

@@ -0,0 +1,160 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const MANIFEST_RELATIVE = 'assets/bootstrap-migrations/managed-baseline-verifier/manifest.json';
+const BOOTSTRAP_MANIFEST = 'PROJECT_BOOTSTRAP.json';
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+export function gitBlobSha(data) {
+  const raw = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const buffer = Buffer.from(raw.toString('utf8').replaceAll('\r\n', '\n'), 'utf8');
+  const header = Buffer.from(`blob ${buffer.length}\0`, 'utf8');
+  return crypto.createHash('sha1').update(header).update(buffer).digest('hex');
+}
+
+function safeRelative(value, label) {
+  if (typeof value !== 'string' || !value || path.isAbsolute(value)) {
+    throw new Error(`Unsafe ${label}: ${value}`);
+  }
+  const normalized = value.replaceAll('\\', '/');
+  if (normalized.split('/').some((part) => !part || part === '.' || part === '..')) {
+    throw new Error(`Unsafe ${label}: ${value}`);
+  }
+  return normalized;
+}
+
+function safeConsumerPath(root, relative) {
+  const normalized = safeRelative(relative, 'Bootstrap migration destination');
+  const resolvedRoot = path.resolve(root);
+  const resolved = path.resolve(resolvedRoot, ...normalized.split('/'));
+  if (resolved !== resolvedRoot && !resolved.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new Error(`Unsafe Bootstrap migration destination: ${relative}`);
+  }
+  return resolved;
+}
+
+function loadManifest(packageData) {
+  const file = path.join(packageData.root, ...MANIFEST_RELATIVE.split('/'));
+  const manifest = readJson(file);
+  if (manifest.schemaVersion !== 1 || manifest.owner !== 'bootstrap') {
+    throw new Error('Invalid Bootstrap migration manifest ownership/schema');
+  }
+  if (manifest.source?.component !== 'bootstrap') {
+    throw new Error('Invalid Bootstrap migration logical source component');
+  }
+  if (!/^[0-9a-f]{40}$/.test(manifest.source?.revision ?? '')) {
+    throw new Error('Invalid Bootstrap migration source revision');
+  }
+  safeRelative(manifest.source?.artifact, 'Bootstrap migration source artifact');
+  if (!/^[0-9a-f]{40}$/.test(manifest.targetGitBlob ?? '')) {
+    throw new Error('Invalid Bootstrap migration target Git blob');
+  }
+  if (!Array.isArray(manifest.supportedPredecessorGitBlobs) || !manifest.supportedPredecessorGitBlobs.every((value) => /^[0-9a-f]{40}$/.test(value))) {
+    throw new Error('Invalid Bootstrap migration predecessor identities');
+  }
+  const assetRelative = safeRelative(manifest.asset, 'Bootstrap migration bundled asset');
+  const asset = path.join(packageData.root, ...assetRelative.split('/'));
+  const bytes = fs.readFileSync(asset);
+  if (gitBlobSha(bytes) !== manifest.targetGitBlob) {
+    throw new Error('Bundled Bootstrap migration asset identity does not match its manifest');
+  }
+  return { manifest, bytes };
+}
+
+export function planBootstrapMigrations(packageData, consumerRoot) {
+  const bootstrapManifest = path.join(consumerRoot, BOOTSTRAP_MANIFEST);
+  if (!fs.existsSync(bootstrapManifest)) return { rows: [], unsafe: [] };
+
+  const { manifest } = loadManifest(packageData);
+  const destination = safeConsumerPath(consumerRoot, manifest.destination);
+  if (!fs.existsSync(destination)) {
+    return {
+      rows: [],
+      unsafe: [{
+        owner: 'bootstrap',
+        state: 'BOOTSTRAP_MIGRATION_UNSUPPORTED',
+        path: manifest.destination,
+        detail: 'Bootstrap-generated verifier is missing; refusing package mutation before a supported migration is established.'
+      }]
+    };
+  }
+
+  const stat = fs.lstatSync(destination);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    return {
+      rows: [],
+      unsafe: [{
+        owner: 'bootstrap',
+        state: 'BOOTSTRAP_MIGRATION_UNSUPPORTED',
+        path: manifest.destination,
+        detail: 'Bootstrap-generated verifier is not a regular file; refusing package mutation.'
+      }]
+    };
+  }
+  const realRoot = fs.realpathSync(consumerRoot);
+  const realDestination = fs.realpathSync(destination);
+  if (realDestination !== realRoot && !realDestination.startsWith(`${realRoot}${path.sep}`)) {
+    return {
+      rows: [],
+      unsafe: [{
+        owner: 'bootstrap',
+        state: 'BOOTSTRAP_MIGRATION_UNSUPPORTED',
+        path: manifest.destination,
+        detail: 'Bootstrap-generated verifier resolves outside the Project root; refusing package mutation.'
+      }]
+    };
+  }
+
+  const currentGitBlob = gitBlobSha(fs.readFileSync(destination));
+  if (currentGitBlob === manifest.targetGitBlob) return { rows: [], unsafe: [] };
+  if (!manifest.supportedPredecessorGitBlobs.includes(currentGitBlob)) {
+    return {
+      rows: [],
+      unsafe: [{
+        owner: 'bootstrap',
+        state: 'BOOTSTRAP_MIGRATION_UNSUPPORTED',
+        path: manifest.destination,
+        detail: `Unknown/custom Bootstrap verifier identity ${currentGitBlob}; refusing to overwrite it.`
+      }]
+    };
+  }
+
+  return {
+    rows: [{
+      owner: 'bootstrap',
+      state: 'MIGRATE_BOOTSTRAP_VERIFIER',
+      path: manifest.destination,
+      fromGitBlob: currentGitBlob,
+      toGitBlob: manifest.targetGitBlob,
+      source: manifest.source
+    }],
+    unsafe: []
+  };
+}
+
+export function applyBootstrapMigrations(packageData, migrationPlan, consumerRoot) {
+  if (!migrationPlan?.rows?.length) return;
+  if (migrationPlan.unsafe?.length) throw new Error('Refusing unsafe Bootstrap migration plan');
+  const { manifest, bytes } = loadManifest(packageData);
+  for (const row of migrationPlan.rows) {
+    if (row.state !== 'MIGRATE_BOOTSTRAP_VERIFIER' || row.path !== manifest.destination) {
+      throw new Error(`Unsupported Bootstrap migration row: ${row.state ?? 'unknown'}`);
+    }
+    const destination = safeConsumerPath(consumerRoot, row.path);
+    if (!fs.existsSync(destination) || fs.lstatSync(destination).isSymbolicLink() || !fs.lstatSync(destination).isFile()) {
+      throw new Error(`Bootstrap verifier changed after preview: ${row.path}`);
+    }
+    const currentGitBlob = gitBlobSha(fs.readFileSync(destination));
+    if (currentGitBlob !== row.fromGitBlob || !manifest.supportedPredecessorGitBlobs.includes(currentGitBlob)) {
+      throw new Error(`Bootstrap verifier changed after preview: ${row.path}`);
+    }
+    fs.writeFileSync(destination, bytes);
+    if (gitBlobSha(fs.readFileSync(destination)) !== manifest.targetGitBlob) {
+      throw new Error(`Bootstrap verifier migration verification failed: ${row.path}`);
+    }
+  }
+}